From 64ae90651447977ce9733e18c6b3f8fdc6383626 Mon Sep 17 00:00:00 2001 From: yml2213 Date: Fri, 28 Aug 2026 22:40:03 +0800 Subject: [PATCH] =?UTF-8?q?feat(huya):=20=E7=99=BB=E5=BD=95hdid=E9=9A=94?= =?UTF-8?q?=E7=A6=BB=E5=AE=9E=E9=AA=8C=20-=20sGuid=E2=89=A0=E7=99=BB?= =?UTF-8?q?=E5=BD=95hdid=E8=AF=81=E4=BC=AA=E6=97=A7=E5=81=87=E8=AE=BE,=20?= =?UTF-8?q?=E7=99=BB=E5=BD=95hdid=3Dnative=E7=A7=81=E9=92=A5=E8=AF=81?= =?UTF-8?q?=E4=B9=A6(APP=5FSIGN=E7=BB=91=E5=AE=9Ahdid=E5=80=BC)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - 原样重放金样本=1571B完整登录数据(R3今夜复现) - 构建金样本hdid=1571B OK-data / 同构建铸币hdid=652B APP_SIGN (唯一变量=hdid) - docs §11.10: 两套32hex体系澄清 + 登录证书两路径 --- docs/HUYA_HDID_ALGORITHM_GEN.md | 26 ++++++++++++++++++ .../mint/login_golden_acct_golden_hdid.bin | Bin 0 -> 1571 bytes evidence/mint/login_golden_acct_mint_hdid.bin | Bin 0 -> 652 bytes 3 files changed, 26 insertions(+) create mode 100644 evidence/mint/login_golden_acct_golden_hdid.bin create mode 100644 evidence/mint/login_golden_acct_mint_hdid.bin diff --git a/docs/HUYA_HDID_ALGORITHM_GEN.md b/docs/HUYA_HDID_ALGORITHM_GEN.md index 3d95de7..904df81 100644 --- a/docs/HUYA_HDID_ALGORITHM_GEN.md +++ b/docs/HUYA_HDID_ALGORITHM_GEN.md @@ -408,3 +408,29 @@ mid = LiveUserbase→tUAEx→t5=sMId (16hex)，**可任意铸造** → doLaunch 但 WUP 登录需要 native 私钥证书重签 (注册链/OTA/safe_auth 证书) —— **登录签名的纯代码复刻 = 下一道关** (记录: AESkeyMgr 钥表 + bigaes 事件已定位, 未复刻)。 4. device_mint 的登录接入 = 完成到"签名边界"可复现: 铸币→注册链→登录→APP_SIGN 恒定复现。 + +## §11.10 登录 hdid 隔离实验: sGuid ≠ 登录 hdid (两个 32hex 体系) (2026-08-28 夜) + +### 隔离实验 (金样本账号 hy_300023887, 同一构建器, 仅换 hdid) +| 请求 | 响应 | 解读 | +|---|---|---| +| 原样重放证据金样本 bin (旧 session/旧 requestId) | 1571B 完整登录数据 | R3 奇迹今夜复现 — **登录链 cred 可用** | +| Python 构建 金样本hdid (ed0db8…) | 1571B OK-data | 构建 = 100% 金样本 (1B 差无关) | +| 同构建 铸币hdid (0a7d91…, doLaunch sGuid) | 652B APP_SIGN_NOT_MATCH | **唯一变量 = hdid** | + +### 决定性澄清: 手机同时存在两个 32hex, 之前文档混为一谈 +- **GUID/sGuid** = `0a7dfaa882938a6ab502511452142c57` (HySignalGUIDCache) —— + **doLaunch 按 mid 签发**, 铸币机已打通 (§11.8)。 +- **登录 hdid** = `ed0db8334cadd236c00cadf7e11ab5a5` (golden) —— **登录帧 t1.t0**, + 格式同为 32hex 但= **另一套服务端校验体系**: 换值 → APP_SIGN_NOT_MATCH 硬错。 +- 目标原始假设 "sGuid → 登录帧 tag0" = **被证伪**: doLaunch 的 sGuid 不能直接作登录 hdid; + 登录 hdid 是 native(libhydeviceid/libudbauthunify 私钥)签发的设备证书, 服务端按 + 证书(而非注册链)校验 —— 纯 Python 铸造 sGuid 后仍需: + (a) native 私钥证书重签 (unidbg 侧差分 / AESkeyMgr 钥表) 或 + (b) 若 hdid=服务端可重签 token, 找到签发 hdid-cert 的 HTTP 通道 (device_register/OTA 变体)。 + +### 已固证据 (evidence/mint/) +- login_golden_acct_golden_hdid.bin (1571B cred 响应) +- login_golden_acct_mint_hdid.bin (652B APP_SIGN) +- login_golden_hdid.bin / login_minted_hdid.bin (测试账号版) +- doLaunch_rsp_gzip_313B_partial.bin diff --git a/evidence/mint/login_golden_acct_golden_hdid.bin b/evidence/mint/login_golden_acct_golden_hdid.bin new file mode 100644 index 0000000000000000000000000000000000000000..59caed51a5550ee8e4e48c43d4de4d98a79ba1f5 GIT binary patch literal 1571 zcmd^9`)^ZK96#MgW$h+xEE~eMkP8-pUbwfn?Y(z{NY}Mp*RI`d_q=H8ZF~FJ`o6cX z!GQQkP!WT{0OMU?JX9Eql7b34Lngt25rYKCcm){=h}mR1h~fqP1^)%lFDK{Zd_SMh z`F=n703e<{HCK*;)inU!Hr7($i>H~m+nHpYaldDZFCAexE*Xxw&0()U)D1+F&QAup zVo(8qs6d?WNX8=$H^Va(K$LecTER!~4S_qZ_IsP!f|vo_NS* zVS+4F1^oval0)8DI39tjP&wom3X}+m%OQ^CH~|5w!W1f0O_IV5&;Ij>xQ zBtc*N2{R(>92?VyLp+<}1u&?4u^zaDAMdO?yKhbcNN3~dD4=^0v0k zn(x^mws_W-#o2v*XGW{*WmoRr${L3c6b)5ue0SrCX@&R0Mj(=i^Hc~zl*2#-GC5`aUnF`}a!=>kN0YvM zePzL#3G=Q8E8br?{lNVfPwKm`yj}U{tH>)GM`jP67}znZZ#n9%&JnGduEUh?j=}TB zpW8j=lF)s{y9fX1#Wp)+RAn}DvU2@E=Ysmuy4Zg4x}kLEk$cNp4z5yd8$R@K*@jaX zJCy%peA)~J?jGuw(HFnlpsaI}FYFmSz4=jK{SWXl@2$rv?i=;8cltBtMQ)>%78jx@ zNvhRq5>={kwDg%a%AS}B7kb^Mp=ttnizd?GHW?d?0X1f@n5<5h;_LlSLF z=~YyHN@u_oj#M-4*1JMzpxsA!>SHt?4dLyC#uKl18og9XW6;wS6*3tbEscHyuC=@Q zpdz7)5DhU+pfwR!<6XSU7PQ#xOpC6SR@)L?;Z_}ms&!$WLpXaNs>9L=%;t?yR-E8M z9Mu^Nxyg2CUDBEK&^4~w29(nJN!m^kQI+4QH#NDqs2*u*!eFZxr5f!`tww7tZ*cqF zbPHkE(r}Pb`rF&MNUDp}*fqXn+Cq24W2Dkbz=n=Uvp0>!+G#upGf^!@Xz)6!CTW5V zyt<3<8*B-pR++}U)@E4Ij5$qOho45;%{q0B&T6q^G?NI}>~x#Mn20&k=Ae_;*?nO} zJJR9Mi%_Yj5JAxSPZzFIDBt+k=;d2?=J$!d1tM{N+~weShG)4_5qciv0Z{&Fx&2zs z_>^a+H9i%L7Xc|*&>)!aNX`V9&+pCcpP66M_$K`Pb%_hF>5+VOY0K@yWtEwAD_ms9 z+PUR-cifygoEW)!HOD-fS({K^n^638;i{#iOf?&P0{^;nLSB4!>l{yob;p8ZcTSxf z7}S?zy&tbiMK2dwE%lkd%0551>&Bxiz0xU#dEJwjeo*qe*TU?{Hh8h?$CdQV!=)Fe z%fzd1e^zlJ9yzme@TEIT#5c3vTQ@RqnMJXompdmG9VOo*Oxw3>EmE=cX`K03#?8ir lKm#NHmpog$sbIe_=VH6jV9}TzcAc%osMR@ax~5VQ@;7`u9|QmZ literal 0 HcmV?d00001 diff --git a/evidence/mint/login_golden_acct_mint_hdid.bin b/evidence/mint/login_golden_acct_mint_hdid.bin new file mode 100644 index 0000000000000000000000000000000000000000..ea828722c199256b2bc5a21445723ef17e55ed77 GIT binary patch literal 652 zcmeH@y-vbV7=}-6QU#i57}!|O;8aWxZRt;3kf4$v5+JP2X?qGyYTNWjB!N-{TS#r8?cvl5gN_3Y z4e62q-7K(s_=-RS{z--coWx-kK?4cUqXt>jRRJa>NoWEzq`HC{x=xjp{5~bA=lk1L z&~UMz5CNt!wn^RwMN4xuAhj+lh&HG5h)$yW zvb4 literal 0 HcmV?d00001